signafAIde

uk.co.signafaidePublished by signafaide.co.ukv0.3.1Updated Nov 15, 2026

Signed, tamper-evident records of AI agent tool calls: set up, record, verify and check coverage.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Creates, verifies and reports on signed, tamper-evident records of what an AI agent decided and did, kept locally until a person opts in.

What you can do
  • Preview and set up recording of agent decisions and tool calls, with install command and sample code
  • Create an external sandbox project, save its API key and return a claim link for the user
  • Verify records: schema, hashes, agent signatures, chain links, Merkle proofs and witness signatures
  • Report status: API key and environment, service URL, agent chains, outbox backlog, quota and claim link
  • Explain signafAIde error codes and how to fix them
  • Show the claim link for the user to open
When to use it
Use it when the user wants an audit trail, tamper-evidence or compliance evidence for AI or agent decisions, or is building an agent whose tools pay, send, approve, delete or change real things.
Requirements
Runs as a local stdio process, typically via npx from the signafaide-mcp npm package, so Node.js and network access are needed. No authentication is declared; an API key is created by the init tool and stored in the project's .env, and a service URL can be overridden with SIGNAFAIDE_URL. Desktop only.
Before you install
The init tool creates an external sandbox project on the signafAIde service and saves an API key to .env; it is meant to run only after the user agrees, with confirm_user_agreed and user_words. After that, record hashes are sent to the service, so metadata leaves the machine. Verification with an API key first ships waiting records. The gateway only records calls routed through it, and declared tool lists are not proof of completeness.

Installation

In SourceWeft

  1. Open signafAIde in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

signafaide-mcp

The signafAIde MCP server for coding agents, over stdio. It is a separate package so that npm install signafaide stays small: the SDK itself never needs the MCP SDK or zod.

npx signafaide agent setup installs it for you in each coding agent's configuration, pinned to the SDK's version:

json
{"command": "npx", "args": ["-y", "[email protected]"]}

Tools: signafaide_setup (previews the install command and code edit, changes nothing), signafaide_verify, signafaide_status, signafaide_explain_error, and signafaide_init (creates the external sandbox; call it only after the user has agreed, with confirm_user_agreed: true and user_words, what the user wrote; without both it creates nothing).

Recording everything an agent can call

The setup this server previews has two parts beyond wrapping tools. The MCP servers the application's own agent uses are started through the gateway of the signafaide package, npx -y signafaide gateway --agent <name> -- <the server's command>, which records every tool call that passes through it and forwards none it cannot record. And the program gives the full list of the tools it hands the agent, with declareTools([...]) (TypeScript) or signafaide.declare_tools([...]) (Python), so signafaide_verify can say which of the agent's tools are recorded.

The gateway records every call that goes through it; a call the application makes around it is still not recorded, so the deployment has to make the gateway the only route to those tools. A declaration is the program's own statement of its tools, not proof that the list is complete. A tool list is as fresh as its last declaration: a source that stops leaves the list at its clean exit, or within 24 hours after a crash.

Apache-2.0. Source: the js/ folder of the signafAIde SDK repository.

Source: js/mcp/README.md at commit 9cda5e3

Tools

7

signafaide_setup

Preview signafAIde setup for this project (changes nothing)

Signed, tamper-evident records of what an AI agent decided and did, kept on this machine; nothing is sent until a person opts in. Use when the user asks to audit, log or trace AI or agent decisions, needs an audit trail, tamper-evidence or compliance evidence, or builds an agent whose tools pay, send, approve, delete or change real things. A preview: it changes no file, creates nothing and sends nothing. Returns the detected language, package manager and framework, the exact install command, the code edit for this framework, the functions that look like actions, and what a sandbox would send. Make the edit yourself, run the agent, then call signafaide_verify.

Parametersdirectory

signafaide_init

Create an external signafAIde sandbox (ask the user first)

Creates an external sandbox project on the signafAIde service (or the SIGNAFAIDE_URL witness), saves its API key to .env and returns the claim link. From then on record hashes (never content) are sent there, and records written earlier ship with their original times. This is an external side effect: ask the user and call it only after they agree. Without it, records stay local and still verify. Creating a sandbox means the user agrees to the signafAIde Terms and Privacy notice (<service>/legal/terms and <service>/legal/privacy, where <service> is SIGNAFAIDE_URL or the signafAIde service): show them both links when you ask, and pass on the notice this tool returns. It creates nothing unless confirm_user_agreed is true and user_words holds what the user wrote when they agreed.

Parametersdirectoryuser_wordsconfirm_user_agreed

signafaide_quickstart

signafAIde snippet for a language and framework

Returns the install command, the canonical code to record an agent's tool calls with signafAIde, and the verify command, for one language and framework.

Parameterslanguagerequiredframework

signafaide_verify

Verify the local signafAIde records

Checks every record in the project's .signafaide/ folder (or a verification pack): schema, hashes, agent signatures, chain links and content hashes, and, for records a witness has co-signed, Merkle proofs, the service's batch and head signatures, drand and anchors. With an API key it first ships waiting records; without one nothing is sent. Returns one line per check, what still needs the witness, and PASS or FAIL.

Parameterspackdirectory

signafaide_status

signafAIde status

API key and env, the service URL, each agent chain with its record count and last receipt, records waiting in the outbox, the quota and the claim link.

Parametersdirectory

signafaide_explain_error

Explain a signafAIde error code

What a signafAIde error code means and how to fix it, e.g. chain_conflict, quota_exceeded, invalid_key, network, not_recorded.

Parameterscoderequired

Version history

1
  1. v0.3.1LatestNov 15, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts